pptx/encryption-envelope-detection

Metadata

XPath assertions

Render assertions

No render assertions declared.

Manifest (expanded)

{
  "$schema": "../manifest.schema.json",
  "id": "pptx/encryption-envelope-detection",
  "title": "Encryption envelope detection (OLE compound file)",
  "format": "pptx",
  "category": "packaging",
  "summary": "Detect an ECMA-376 Part 2 Annex K encrypted .pptx by its OLE Compound File signature.",
  "roles": [
    "authoring"
  ],
  "spec": {
    "source": "ecma-376-5-part-2",
    "clause": "Annex K",
    "notes": "See docx/encryption-envelope-detection for the detection pattern. The OLE envelope is format-agnostic — the first 8 bytes `D0 CF 11 E0 A1 B1 1A E1` are what identifies encryption, regardless of whether the inner ZIP is a .docx, .pptx, or .xlsx. The committed fixture is a 512-byte OLE-header stub (same file used by docx/encryption-envelope-detection; detection happens at byte 0 before any format sniffing). A fully-encrypted real .pptx would require `msoffcrypto-tool` or [MS-OFFCRYPTO] AES-CBC authoring; that is deferred, and the magic-bytes check is sufficient to exercise the loader's encryption detection path."
  },
  "fixtures": {
    "machine": "pptx/encryption-envelope-detection"
  },
  "assertions": [
    {
      "id": "ole-compound-file-magic",
      "kind": "magic_bytes",
      "offset": 0,
      "must": "equal",
      "value": "D0 CF 11 E0 A1 B1 1A E1",
      "description": "Bytes 0-7 of the encrypted .pptx MUST be the OLE Compound File signature."
    }
  ]
}